A business model change is a shift in how a software project is funded, supported, distributed, or offered to users. For an open-source project, the code may remain identical while new commercial activity or a changed market role affects who is responsible for the software and which regulatory duties may apply.
This matters in cybersecurity because compliance obligations can shape security processes, documentation, and deadlines. Under frameworks such as the EU Cyber Resilience Act, a change in a project’s business context may warrant reassessing its regulatory role; it does not automatically determine that role. Maintainers, vendors, and adopters should review monetization, support arrangements, responsibility for the product, and applicable security requirements when the project’s model changes.